 
 (s/defschema History
   "See http://stixproject.github.io/data-model/1.2/incident/HistoryItemType/"
-  {(s/optional-key :action_entry) [COARequested]
-   (s/optional-key :journal_entry) s/Str ;; simplified
+  {(s/optional-key :action_entry)
+   (describe [COARequested] "a record of actions taken during the handling of the Incident")
+   (s/optional-key :journal_entry)
+   (describe s/Str "journal notes for information discovered during the handling of the Incident") ;; simplified
    })
 
 (s/defschema Incident


(s/defschema DirectImpactSummary
  "See http://stixproject.github.io/data-model/1.2/incident/DirectImpactSummaryType/"
  {(s/optional-key :asset_losses) v/ImpactRating
   (s/optional-key :business_mission_distruption) v/ImpactRating
   (s/optional-key :response_and_recovery_costs) v/ImpactRating})

(s/defschema IndirectImpactSummary
  "See http://stixproject.github.io/data-model/1.2/incident/IndirectImpactSummaryType/"
  {(s/optional-key :loss_of_competitive_advantage) v/SecurityCompromise
   (s/optional-key :brand_and_market_damage) v/SecurityCompromise
   (s/optional-key :increased_operating_costs) v/SecurityCompromise
   (s/optional-key :local_and_regulatory_costs) v/SecurityCompromise})

(s/defschema LossEstimation
  "See http://stixproject.github.io/data-model/1.2/incident/LossEstimationType/"
  {(s/optional-key :amount) s/Num
   (s/optional-key :iso_currency_code) s/Str})

(s/defschema TotalLossEstimation
  "See http://stixproject.github.io/data-model/1.2/incident/TotalLossEstimationType/"
  {(s/optional-key :initial_reported_total_loss_estimation) LossEstimation
   (s/optional-key :actual_total_loss_estimation) LossEstimation})

(s/defschema ImpactAssessment
  "See http://stixproject.github.io/data-model/1.2/incident/ImpactAssessmentType/"
  {(s/optional-key :direct_impact_summary) DirectImpactSummary
   (s/optional-key :indirect_impact_summary) IndirectImpactSummary
   (s/optional-key :total_loss_estimation) TotalLossEstimation
   (s/optional-key :impact_qualification) v/ImpactQualification
   (s/optional-key :effects) [v/Effect]
   ;; Not provided: external_impact_assessment_model
   })


            [cia.schemas.relationships :as rel]
            [cia.schemas.vocabularies :as v]
            [schema.core :as s]
            [ring.swagger.schema :refer [describe]]
            [schema-tools.core :as st]))

(s/defschema COARequested
  "See http://stixproject.github.io/data-model/1.2/incident/COARequestedType/
   and http://stixproject.github.io/data-model/1.2/incident/COATakenType/"
  {(s/optional-key :time)
   (describe c/Time "relative time criteria for this taken CourseOfActio")
   (s/optional-key :contributors)
   (describe [c/Contributor] "contributing actors for the CourseOfAction taken")
   :COA (describe rel/COAReference "COA reference")})

(s/defschema NonPublicDataCompromised
  "See http://stixproject.github.io/data-model/1.2/incident/NonPublicDataCompromisedType/"
  ;; Simplified schema
  {:security_compromise
   (describe v/SecurityCompromise "related security compromise")
   (s/optional-key :data_encrypted)
   (describe s/Bool "whether the data that was compromised was encrypted or not")})

(s/defschema PropertyAffected
  "See http://stixproject.github.io/data-model/1.2/incident/PropertyAffectedType/"
  {(s/optional-key :property)
   (describe v/LossProperty "security property that was affected by the incident")
   (s/optional-key :description_of_effect)
   (describe s/Str "a brief prose description of how the security property was affected")
   (s/optional-key :type_of_availability_loss)
   (describe s/Str "characterizes in what manner the availability of this asset was affected") ;; Vocab is empty
   (s/optional-key :duration_of_availability_loss)
   (describe v/LossDuration "approximate length of time availability was affected")
   (s/optional-key :non_public_data_compromised)
   (describe NonPublicDataCompromised "approximate length of time availability was affected")})

(s/defschema AffectedAsset
  "See http://stixproject.github.io/data-model/1.2/incident/AffectedAssetType/"
  {(s/optional-key :type)
   (describe s/Str "type of the asset impacted by the incident (a security attribute was negatively affected).")
   (s/optional-key :description)
   (describe s/Str "text description of the asset")
   (s/optional-key :ownership_class)
   (describe v/OwnershipClass "high-level characterization of who owns (or controls) this asset")
   (s/optional-key :management_class)
   (describe v/ManagementClass "high-level characterization of who is responsible for the day-to-day management and administration of this asset")
   (s/optional-key :location_class)
   (describe v/LocationClass "high-level characterization of where this asset is physically located")
   (s/optional-key :property_affected)
   (describe PropertyAffected "affected property") ;; Unnested NatureOfSecurityEffect
   (s/optional-key :identifying_observables) [c/Observable]
   ;; Not Provided: business_function_or_role
   ;; Not Provided: location (undefined/abstract type); Could be [s/Str]
